Read the docs
TI-2026-33129 Aliases CVE-2026-45332GHSA-xm76-r88j-vm3g

Information disclosure in marcantondahmen automad

Priority HIGH 72CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-306.

Summary

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01417 72nd percentileScored 2026-11-07
Fix Fixed automad (marcantondahmen): 2.0.0-beta.28automad/automad (Packagist): 2.0.0-beta.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
marcantondahmenautomad2.0.0-alpha.1 to before 2.0.0-beta.282.0.0-beta.28Patch availableCNA
—automad/automad (Packagist)2.0.0-alpha.1 to before 2.0.0-beta.282.0.0-beta.28Patch availableGHSA-xm76-r88j-vm3g
  • automad Vendormarcantondahmen Affected 2.0.0-alpha.1 to before 2.0.0-beta.28 Fixed in 2.0.0-beta.28 Patch available CNA
  • automad/automad (Packagist) Vendor— Affected 2.0.0-alpha.1 to before 2.0.0-beta.28 Fixed in 2.0.0-beta.28 Patch available GHSA-xm76-r88j-vm3g

Remediation

  • Fix · CNA automad (marcantondahmen) Fixed in 2.0.0-beta.28
  • Fix · GHSA-xm76-r88j-vm3g automad/automad (Packagist) Fixed in 2.0.0-beta.28 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45332
  2. 2026-10-03 Alias added: GHSA-xm76-r88j-vm3g

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences